Analysis
-
max time kernel
28s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
23-03-2023 16:41
General
-
Target
MatSploit.exe
-
Size
1.6MB
-
MD5
28bb98b32516829a00facf1232514479
-
SHA1
2c3fe53d4ddaa31bb09d3136ea8102697a0ebcf9
-
SHA256
6de25bc2a38be29578d61366fd5a789a58896dbe1c467f305f31e289d120e4a5
-
SHA512
8c121038c006039b057fe424d586647e732ee18f33526d7cee32b955666c0930ce6023cf45cfa2511a765f6c8a1fe0a6f5618bc9d88ae094ed86790edcd8a0ac
-
SSDEEP
49152:ySIgFm/3uuUX4ykWAfi313LfCzCcwSGO:HIgFmHUGaF3jecSGO
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MatSploit.exe"C:\Users\Admin\AppData\Local\Temp\MatSploit.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 15682⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-54-0x0000000000190000-0x000000000032E000-memory.dmpFilesize
1.6MB
-
memory/1232-55-0x0000000007090000-0x00000000070D0000-memory.dmpFilesize
256KB
-
memory/1232-56-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/1232-57-0x00000000020B0000-0x00000000020B1000-memory.dmpFilesize
4KB
-
memory/1232-58-0x0000000007090000-0x00000000070D0000-memory.dmpFilesize
256KB